Re: [lamps] draft-housley-lamps-norevavail-00

Seo:

id-pkix-ocsp-nocheck is to avoid asking an OCSP Responder for status for its own certificate.

Russ

> On May 19, 2023, at 3:47 PM, Seo Suchan <tjtncks@gmail.com> wrote:
> 
> I thought id-pkix-ocsp-nocheck already remove revocation check, but realized that's only for ocsp check - clients seeing certs with id-pkix-ocsp-nocheck extension expected to check CRL for that certificate? only thing it currently used is for designated OCSP responder(for root iirc?). and don't think it runs CRL for it.
> 
> 2023-05-19 오전 6:23에 Russ Housley 이(가) 쓴 글:
>> I want the LAMPS WG to be aware of this I-D.  However, I do not think we should adopt it until the event predicted in the History section actually comes to pass:
>> 
>>    With greater use of short-lived certificates in the Internet, the
>>    next revision of ITU-T Recommendation X.509 [X.509-TBD] is expected
>>    to allow the noRevAvail certificate extension to be used with public
>>    key certificates as well as attribute certificates.
>> 
>> Russ
>> 
>> 
>>> From: internet-drafts@ietf.org <mailto:internet-drafts@ietf.org>
>>> Subject: New Version Notification for draft-housley-lamps-norevavail-00.txt
>>> Date: May 18, 2023 at 4:51:35 PM EDT
>>> To: "Joseph Mandel" <joe.mandel@secureg.io <mailto:joe.mandel@secureg.io>>, "Russ Housley" <housley@vigilsec.com <mailto:housley@vigilsec.com>>, "Tomofumi Okubo" <tomofumi.okubo+ietf@gmail.com <mailto:tomofumi.okubo+ietf@gmail.com>>
>>> 
>>> 
>>> A new version of I-D, draft-housley-lamps-norevavail-00.txt
>>> has been successfully submitted by Russ Housley and posted to the
>>> IETF repository.
>>> 
>>> Name:		draft-housley-lamps-norevavail
>>> Revision:	00
>>> Title:		No Revocation Available for Short-lived X.509 Certificates
>>> Document date:	2023-05-18
>>> Group:		Individual Submission
>>> Pages:		8
>>> URL:            https://www.ietf.org/archive/id/draft-housley-lamps-norevavail-00.txt <https://www.ietf.org/archive/id/draft-housley-lamps-norevavail-00.txt>
>>> Status:         https://datatracker.ietf.org/doc/draft-housley-lamps-norevavail/ <https://datatracker.ietf.org/doc/draft-housley-lamps-norevavail/>
>>> Html:           https://www.ietf.org/archive/id/draft-housley-lamps-norevavail-00.html <https://www.ietf.org/archive/id/draft-housley-lamps-norevavail-00.html>
>>> Htmlized:       https://datatracker.ietf.org/doc/html/draft-housley-lamps-norevavail <https://datatracker.ietf.org/doc/html/draft-housley-lamps-norevavail>
>>> 
>>> 
>>> Abstract:
>>>   Short-lived X.509v3 public key certificates as profiled in RFC 5280
>>>   are seeing greater use in the Internet.  The Certification Authority
>>>   (CA) that issues these short-lived certificates do not publish
>>>   revocation information because the certificate lifespan that is
>>>   shorter than the time needed to detect, report, and distribute
>>>   revocation information.  This specification defines the noRevAvail
>>>   certificate extension so that a relying party can readily determine
>>>   that the CA does not publish revocation information for the
>>>   certificate.
>> 
>> 
>> _______________________________________________
>> Spasm mailing list
>> Spasm@ietf.org <mailto:Spasm@ietf.org>
>> https://www.ietf.org/mailman/listinfo/spasm <https://www.ietf.org/mailman/listinfo/spasm>